CVE-2022-22797: falha de média gravidade em Sysaid
Sysaid – sysaid Open Redirect
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.6epss 0.5%
Sysaid – sysaid Open Redirect - An Attacker can change the redirect link at the parameter "redirectURL" from"GET" request from the url location: /CommunitySSORedirect.jsp?redirectURL=https://google.com. Unvalidated redirects and forwards are possible when a web application accepts untrusted input that could cause the web application to redirect the request to a URL contained within untrusted input. By modifying untrusted URL input to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
SysAid · SysaidCVEs relacionadas — Sysaid
No mesmo produto, das mais perigosas para as menos.
CVE-2022-22796HIGHSysaid – Sysaid System TakeoverEPSS 1.4%CVE-2022-23166MEDIUMSysaid – Sysaid Local File Inclusion (LFI)EPSS 1.1%CVE-2022-22798MEDIUMSysaid – Pro Plus Edition, SysAid Help Desk Broken Access ControlEPSS 0.6%CVE-2022-23165MEDIUMSysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting (XSS)EPSS 0.4%